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SYSTEM AND METHOD FOR DEVELOPING SOFTWARE 
UTILIZING DETERMINATIVE REPRESENTATIONS 

FIELD OF THE INVENTION 

The present invention relates generally to models and representations utilized in 
generating software. More particularly, the present invention relates to a system for and a method 
of creating software utilizing a deterministic model or a representation of a complex control 
system. 
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BACKGROUND OF THE INVENTION 

Software often must be designed and developed as part of a large and complex 
reactive system. A reactive system is utilized in a variety of applications, such as, 
telecommunications, automobiles, computer networks, personal computers, avionic systems, 
process controls, man-machine interfaces, and other systems. Generally, reactive systems are 
event driven and continuously react to external and internal stimuli. The external and internal 
stimuli can be human operator initiated or can be provided from completely external equipment or 
happenings. 

One type of reactive system is a graphical user interface for flight plan editing in a 
graphical flight management system (FMS). Developing software for a reactive system, such as, 
the graphical user interface, requires that the behavior of the reactive system be modeled or 
represented in a formal fashion. 

Generally, the reactive system can be modeled or represented as a state machine. A 
state machine is an abstract control model consisting of a set of states, a set of input events, a set of 
output actions and a state transition function. A function takes the current state and an input event 
and returns a set of output events and the next state. Some states may be designated as "terminal 
states." A terminal state is an ending state from which the state machine does not exit. 

The state machine can also be viewed as a function which maps an ordered sequence 
of input events into a corresponding sequence of (sets of) output events. State machines are often 
represented by state transition diagrams to effectively specify the behavior of reactive systems. 
Statecharts are a type of state transition diagram described in more detail below. Statecharts 
efficiently represent a set of states and the transition between states based upon events. The 
graphical notation associated with statecharts is easily understandable and can be utilized to support 
discussions and conversations about the system. Such a representation or graphical notation is 
highly valuable when evaluating the workings of a graphical user interface. 

State machines can be deterministic or non-deterministic. A deterministic state 
machine is one where the next state is uniquely determined by a single input event. A non- 
deterministic state machine may have several possible next states for a given input event. The next 
state that is actually chosen may either be chosen randomly or it may be chosen based upon an 
arbitrary number of subsequent input events. In the latter case, until these subsequent events 
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occur, it is not possible to determine the state within which the machine resides. It is generally 
possible to automatically translate a non-deterministic state machine into a deterministic one which 
will produce the same output given the same input. 

Simple statecharts or state transition diagrams, such as deterministic finite 
automations (DFA), have been utilized to study languages, such as programming languages. The 
goal of such simple state transition diagrams is to allow the state machine to determine whether or 
not a given word is contained in a language. A DFA has a finite set of states and transitions where 
each transition leads from one state to another. Each transition is associated with a particular input 
character; the transition can only cause a change in the active state when that particular input 
character is read from the input word. At any given time, only one of the states is active, i.e., the 
next input character (read from the word to be recognized) is able to activate only those transitions 
that depart from the active state. 

One state is the designated start position (it is active state when the first input 
character is read). One or more states are defined as terminating states. After the input word has 
been read completely, if the state machine has arrived to a terminating state, the word is accepted. 
Otherwise, the word is rejected (i.e., not in the language recognized by the DFA). The set of 
languages that can be recognized by DFAs equals the set of languages that can be described using 
regular expressions. Therefore, this set of languages is called regular languages. 

Several extensions of more advanced concepts of state transition systems have been 
proposed. Some extensions introduce more complex languages than regular languages and others 
better support tasks not related to programming languages. As a trend of controlling systems by 
computers and software increases, many more systems are represented as being state based. Using 
automations and state transition diagrams to specify these systems becomes increasingly more 
popular and effective. A significant difference between the described Conventional extensions and 
more advanced concepts to state transition systems when compared to DFAs is that these extensions 
do not include a terminating state. Although these computer systems can be switched off and thus 
are forced to terminate, these systems no longer recognize or reject words of finite length. 

DFAs are not appropriate for more complex application which do not include 
terminating states. With the exception of certain military applications, the complex systems are 
often designed so that they can potentially operate forever. Although it is possible to specify 
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behavior of a complex system such as a graphical interface (GUI) using DFAs, an exceedingly 
large number of transitions and states is necessary due to global options and parallel execution, 
respectively. 

Another difference between the described conventional extensions and more 
advanced concepts is that state transitions in complex systems are not triggered by characters read 
from an input word as in a DFA system. Rather, external events drive the systems. For example, 
external events can be keystrokes, expiration of timers, arrival of messages from another computer, 
sensor signals, mouse clicks, etc. These events are called external because their source is outside 
of the state machine. The events are also discrete in that they either occur or do not occur. Events 
which are recognized by the state machine can lead to changes or transitions in the state. Events 
that are not recognized do not cause a change in the active state (the system continues to run in its 
present active state). There is no equivalence of rejecting an input word as utilized in a DFA. 

Generally, non^eterministic statecharts can be converted to an equivalent 
deterministic statechart if both machines recognize the same language. However, the deterministic 
statechart becomes extremely complex because the definition of equivalence of automations is not 
helpful. Also, there is a need for a deterministic statechart that can provide a specification for a 
reactive system. One type of statechart system utilizes a Hard statechart which is fully described 
in Harel, "Statecharts: A Visual Formalism for Complex Systems" Science of Computer 
Programming 8 (1987), pp. 231-274. Harel statecharts are well known by one of ordinary skill in 
the art. However, Harel statecharts are not deterministic. There is nothing in its rules which 
prevent two different states from being the result of the same input criteria. 

Thus, there is a need for a deterministic state machine defined by statecharts. 
Further, there is a need for a deterministic statechart that can be used to design complex reactive 
systems, such as, avionic software. Further still, there is a need for a modified Harel statechart 
which is deterministic. 


Ul 
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SUMMARY OF THE INVENTION 

^\ ^> A»-exeroEla^ei^odiment relates to a statechart for use in the development of 
avionic software. The avionic softwafe^eqjiires deterministic behavior. The statechart includes a 
first state, a second state and a third state. The thir3l!Tate4iidudes the first and second parallel 
states. The first state is ordered with respect to the second state !ihe*state chart does not allow 
parallel states to be an ordered to ensure deterministic behavior of the statechart^-^ 
\3j^ / ^^^^^^Smtvii relates to a modified Harel statechart formed an a computer. 
The modified Harel stateclufl^icludes a mathematical representation of a group of states. The 
group of states includes a first state including'u^lurality of ordered parallel states. The 
mathematical representation ensures deterministic operation, 
p Still another embodiment relates to a computer code for statechart editor. The 

^ computer code includes code for generating a graphical representation of a state including parallel 
states and code for ordering the parallel states. 

Still another embodiment relates to a method of providing avionic software. The 
method includes providing a graphical representation of a state, and applying the graphical 
representation to an execution engine to create the avionic software. The state includes a plurality 
of parallel states which are ordered with respect to each other. The parallel states are ordered so 
that only one of the parallel states is active in response to a particular event. 

Yet still another embodiment relates to a statechart for use in the development of 
software for an application. The statechart includes a first state means, a second means, and a third 
state means. The first state means represents a first condition of the software in the application. 
The second state means indicates a second condition and is within the first state means. The third 
state means represents a third condition and is also within the first state means. The third state 
means is ordered with respect to the second state means. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Exemplary embodiments will hereafter be described with reference to the 
accompanying drawings, wherein like numerals denote like elements, and: 

FIGURE 1 is a schematic block diagram of a system for generating software in 
accordance with an exemplary embodiment the program system including a statechart editor; 

FIGURE 2 is a schematic block diagram of a statechart for use in the system 
illustrated in FIGURE 1; 

FIGURE 3 is a schematic drawing of a screen utilized by the statechart editor 
illustrated in FIGURE 1; and 

FIGURE 4 is a schematic block diagram of a statechart including a tree structure in 
p accordance with still another exemplary embodiment of the present invention. 


-6- 


PATENT 
99CR125/KE 


DETAILED DESCRIPTION OF PREFERRED EXEMPLARY EMBODIMENTS 

In FIGURE 1, a system 10 includes a software engine 12, a control unit 20 and an 
operator interface 24. System 10 can be a software/hardware system for avionics applications, 
such as flight management systems (EMS) capable of flight planning functions. Alternatively, 
system 10 can be utilized in other complex reactive systems. 

Control unit 20 includes a statechart editor 32, a script editor 34, scripts 35, 
statecharts 36, a runtime environment 38, and a script interpreter 40. Control unit 20 can be a 
STAR/graphical control display unit. Control unit 20 serves as a translator for interpreting 
commands from interface 24 and providing instructions to engine 12. The various states associated 
with system 10 exist in unit 20. Interface 24 can allow the user to visualize these various states as 
discussed in more detail below. 

Interface 24 is any system which allows user commands to be input into system 10. 
Interface 24 can include keyboards, keypads, mouse devices, trackballs, joysticks or other 
interfaces. Interface 24 can be a VIVID/GUI interface which includes a graphical editor and 
prototype development tool for avionics displays. 

Engine 12 can be an actual Flight Management System or a VISTA/FMS engine. 
The VISTA/FMS engine is an aircraft simulation software tool which provides functions associated 
with an FMS, such as, flight planning. 

Statechart editor 32 is a software tool capable of creating and revising graphical 
representations of statecharts 36 through interface 24 or through a computer. Graphical statechart 
editor 32 can create statecharts 36 which are executed by runtime environment 38. Preferably, 
statecharts 36 are fully deterministic and can advantageously be utilized for avionics software 
development, such as, flight maintenance systems. Editor 32 is preferably an editor capable of 
graphically editing and defining states and transitions for system 10. 

Run time environment 38 is a hardware or software tool capable of executing 
statecharts 36. Run time environment 38 executes statecharts 36 and interacts with engine 12 to 
operate a state machine in accordance with statecharts 36. 

Script editor 34 is a textural editor capable of creating and editing scripts 35. Scripts 
35 are executed by script interpreter 40. Script interpreter 40 can be closely related to run time 
environment 38. 
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With reference to FIGURE 2, an exemplary statechart 50 of statecharts 36 (FIGURE 
1) is shown. Statechart 50 is a graphical representation that can be edited or created on editor 32. 
Statechart 50 includes a superstate 51, a state 76 and a state 78. Superstate 51 includes a parallel 
state 52 and a parallel state 54. Parallel state 52 includes a substate 56 and substate 66, and parallel 
state 54 includes a substate 58 and substate 68. State 78 includes a substate 86 and substate 88. 

When the state machine (partially represented by statechart 50) is in superstate 51, 
the state machine can be either in parallel state 52 or parallel state 54. From substate 56 of parallel 
state 52, the state machine enters a substate 66 upon an event A. From substate 66 of parallel state 
52, state machine enters a substate 56 upon an event B. From substate 56 of parallel state 52, state 
machine enters state 76 upon event E, thereby leaving parallel statd 52 and superstate 51. 

Similarly, from substate 58 of parallel state 54, the state machine enters substate 68 
upon an event C. From substate 68 of parallel state 54, the state machine enters substate 58 upon 
an event D. From substate 68 of parallel substate 54, the state machine enters state 78 upon event 
E leaving parallel state 54 and superstate 51. 

The described transitions are all readily ascertainable from the graphical 
representation of statechart 50 shown in FIGURE 2. Statechart 50 allows events, states and 
substates to be analyzed in a convenient fashion. For example, the state machine enters state 76 or 
state 78 from superstate 51 upon an event E, depending upon the state within which the machine 
resides (substate 56 or substate 68). If the state machine is in substate 56 of parallel state 52 and in 
substate 68 of parallel state 54, it enters state 76 upon an event due to the priority of parallel state 
52 over parallel state 54. 

As shown in FIGURE 2, various graphical symbols convey information about the 
operation of the state machine. For example, rectangles represent superstates, or substates and 
arrows represent events. Superstate 51 includes several states such as states 56, 58, 66 and 68. 
Dashed line 70 indicates that superstate 51 is a parallel superstate including two parallel states 52 
and 54. Superstate 51 including parallel states 52 and 54 has all of its parallel states 52 and 54 
active when superstate 51 is active. State 78 only has one of substates 86 or 88 active because 
substates 86 and 88 are not parallel states. 

Superstate 51 can include several more parallel states. In addition, any of substate 
56, 58, 66, 68, 86 and 88 or states 76 and 78 can include parallel states. Unlike parallel states as 
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defined by Harel, statechart 50 has an order or priority to parallel states 52 and 54 to ensure that 
statechart 50 is determinative. That is, left-to-right ordering can be utilized wherein the same event 
(e.g., event E) can cause the entry into two states 76 and 78. The left-to-right priority indicates 
that state 76 will be entered when the state machine resides in substates 56 and 68 upon event E. 
Alternatively, a subscript notation can be utilized in each of parallel states 52 and 54 to indicate the 
priority of parallel states 52 and 54. In another embodiment, an up and down orientation or right- 
to-left orientation can determine the priority between parallel states 52 and 54. More complex 
embodiments of statecharts can also be utilized. 

When state 78 is active, either state 88 or 86 is active. When parallel states 54 52 
are active, one of substate 56 or 66 and one of substate 58 or 56 is active. The graphical notation 
wherein superstate 51 encompasses parallel states 52 and 54 simplifies the logical demonstration of 
statechart 50. 

Substate 56 can also include a history element 82. History element 82 is utilized to 
indicate that substate 56 should be entered the next time parallel state 52 is entered. For example, 
if state 56 was exited when the state machine entered state 76 upon event E, the next time the state 
machine enters parallel state 52 it enters state 56 as opposed to state 66 as symbolized by history 
element 82. Similarly, state 58 can be associated with a history element 84. 

With reference to FIGURE 3, a screen 150 for provision by statechart editor 32 
(FIGURE 1) is disclosed. Screen 150 includes a superstate 152 (flight deck). Superstate 152 
includes a parallel state 154 (auto pilot), a parallel state 156 (weight on wheels), and a parallel state 
158 (MFD). Parallel state 154 includes a substate 162 (engaged) that includes a parallel substate 
164 (lateral) and a parallel substate 166 (vertical). Parallel state 154 also includes a substate 155 
(disengage) that includes a history element 157. Parallel substate 164 includes a substate 168 
(FMSLNAV), a substate 170 (approach), a substate 172 (heading), and a substate 174 (lateral off). 
Substate 174 includes a history element 176. 

Parallel substate 166 includes a substate 180 (glide scope), a substate 182 
(FMSVNAV), a substate 184 (altitude), and a substate 186 (vertical off). Substate 186 includes a 
history element 188. Substate 184 also includes a substate 192 (intercept), a substate 194 (altitude 
hold), and substate 196 (FL change). Substate 196 includes history element 198. 
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Parallel state 156 includes a substate 202 (no) and a substate 204 (yes). Substate 204 
includes a history element 206. Parallel state 158 includes a substate 210 (flight progress), a 
substate 212 (EICAS), and substate 214 (map). Substate 210 includes a history element 216. 

As can be seen on screen 150 in FIGURE 3, when superstate 152 is active (state 
machine resides in superstate 152), one substate in each of parallel states 154, 156 and 158 is 
active. The particular example shown in FIGURE 3, includes substate 155, substate 204 and 
substate 210 in an active state. For simplicity, screen 150 is not shown with events associated with 
the various states. 

In FIGURE 4, a statechart 300 similar to statechart 50 includes superstate 302 (R). 
Superstate 302 includes a state 304 (B) including a parallel state 306 (C) and a parallel state 308 
(D). Parallel state 306 includes a substate 312 (E) and a substate 314 (F). Parallel state 308 
includes a substate 316 (G) and a substate 318 (H). State 302 also includes a state 320 (A) and a 
state 330 (I). The state relationship can be represented in a simplified tree structure 340 in 
FIGURE 4 where arrows represent the relationship between states. 

As shown in tree structure 340, superstate 302 includes state 304, state 320 and state 
330. State 304 includes parallel states 306 and 308. Parallel state 306 includes states 312 and 314. 
Parallel states 308 include states 316 and 318. Events are not shown in statechart 300 for 
simplicity. 

A mathematical discussion describes the concepts behind the advantageous statechart 
system discussed with reference to FIGURE 2. The mathematical discussion provides notations for 
describing the syntax associated with statecharts. The syntax is provided as an exemplary 
embodiment only and is not shown to limit the scope of the claims. 

Statecharts Syntax 

Notation: 

1. States: S={s 1 ,.. r) S n } 

2 s x{AND}x2 {SxS) 

2. Hierarchy: p:S^>v 2 s x{XOR}xS 

u {terminal} 


PATENT 
99CR125/KE 


3. Events: E = {e l9 ... 9 e m }v{e 0 } 

4. Actions: A = { Ql Qq } 

5. History States: cS 

6. Transitions: T c2 s xEx2 s xA 

The number of states (n) is, of course, finite; therefore, we can enumerate the states 
(1). Each state can either be terminal (leaf), i.e. it has no substates, state 76 or it can be further 
divided into substates, (e.g. superstate 51, parallel states 52 and 54, and state 78) thereby defining 
a hierarchy. Substates can be of two types: AND and XOR decomposition. XOR decomposition 
defines hierarchy; whenever the parent state (e.g., state 78) is active, exactly one of its substates 
(e.g. substates 86 or 88) is active, too (thus XOR). This is used to refine a general parent state. A 
default state needs to be specified to determine which of the substates becomes active should the 
parent state be activated. 

AND decomposition is used to define parallel states (e.g., parallel states 52 and 54). 
Whenever the parent state (e.g., superstate 51) is active, all of its substates (parallel states 52 and 
54) are active, too (AND). There is no need for a default state. Instead, a total order for the 
substates has to be specified; this is what the relation is for (^^c SxS). Notation (2) shows the 
hierarchy function p that, for each state, defines it to be a terminal state or a parent state of AND 
or XOR substates, with a default state in the latter case. 

Notations (3) and (4) enumerate the events and actions. There is no distinction 
between internal and external actions or events, respectively. e 0 is the'designated empty event 
which indicates that none of the actual events has occurred. Notation (5) lists the history states. 
Notation (6) defines the transitions. Transitions consist of a source set of states that have to be 
active before the transition can become active, a triggering event, a target state set and a resulting 
action. 
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Definition: (Descendants) 

For a set of states S, a state seS, and a hierarchy function p as defined above, we 


p'(s) denotes only the substates of s, without the additional type and default state information. 

We extend the definition of p' to handle sets of states as arguments, too. For a 
subset S'cz S we define: 

8. p^S') :=Up'(s), thus the extended function is p': Su2 s ^2 s . 


Definition: (root state) 

For a set of states S and a hierarchy function p as above, we define: 
9. s is a root state :<=> Vs'e S,sV s : s g p'(s') 
notation: s e Root (S,p) 
Definition: (substate closure) 

For a set of states S, a state s € S, and a hierarchy function p as defined above, we 


define a descendants function p': S -> 2 s as follows: 

f Sub andA S )A SU Knd> AND ^AN^ 



define: 



Note: p ,(n) (s) denotes applying p'n times. 
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Definition: (Statechart) 

For S, E, A, T, p and defined as above, we define: 
SC = (S, E, A, T, p, is a statechart : <=> 

|Root(S,p)| = l 

notation : Root(S, p) = {s^, } 

(unique root state) 

• V s € S: 

p(s)= terminal 

v p(s) = (S sub , AND.^Kub * { USsub^ANo) totally ordered set 
vp(s) = (S sub ,XOR, Sdef ),S sub *{}, 

S def G S sub 

(well-defined hierarchy function, default states) 

• VSgS,s 15 s 2 ep ! (s):p*(s 1 )np*(s 2 )^{ }^s, =s 2 
p'(s) = S sub ^seS sub 

(tree structure of states) 

S hist c{sg S|p(s) = (S sub , XOR, s def )} for suitable S sub , s def 
(history states) 

# * = (Ssource' e 'Starget> a )>t' = (^'source > e >S f target j^S^^ C S' source vS'^^ (Z S SQUrce 
=> t = t' 

(no two transitions shall share their event and their source states) 

# * = source > e > arget > a )> * = source ' e 0 ? ^ t , a ), S source CI S source vS S0Ufce C S source 
=> t = t' 

(no two transitions shall share their source states is one of them is associated 
with the empty event) 
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• teT,t = (s source ,e,S laisel ,a\ 

=> V* e (S source \ S mol )(J S mgel : e S : p{s „<,„„,)= 
(S^XOR^JaseS, 


sub 

(source states - except root state - and target states have to be recruited from 
XOR children) 
• t e T,t = (S sourcc ,e, S target , a) 

=>{s*| (s*,hist)is a configuration a S targct cS*}^{ } 

(target state set has to be consistent, i.e. there is a configuration that contains 
the target state set) 

Q Thus, for (S, E, A, T, p, S^J to be a statechart, one (and only one) root state 

S - • 

01 (named S root ) exists. The hierarchy function p must be well-defined, default states must actually be 

yi 

m chosen from the available sub states. Also, p must define a tree structure. This is ensured by the 
~1 requirement that the sets of substates of sibling states are pairwise disjoint. History states can be 
Ln chosen only from those states for which XOR decomposition is defined. Finally, a number of 
h requirements are specified for transitions: they must have either different source sets or different 
j=y events, the target and source states must be XOR children, and no transition must specify an 
M inconsistent target set. 

^ Statechart Configuration: 

For a statechart SC = (S, E, A, T, p, S hist ), a history function hist : S hist -» S, hist 
well-defined, and a set S activc of active states, we define: 

12. C sc = (S active , hist) is a configuration : » 

^root ^ S active 

s € S active , p(s) = (S sub , XOR, s def ) => | {s' e | s'€ S^} | = 1 
s e S active , p(s) = (S^, AND, < AND ) => V s' e : s' e 
s <£ S active , p'(s) = (S^) => n S active = { } 
hist(s) = s h => p(s) = (s^, XOR, s def ) and s h € 
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Thus, the designated root state is always active. For an active XOR parent state, 
one (and only one) of its substates is active, too. For an active AND parent state, all of its 
substates are active, too. For an inactive parent, all of its substates are inactive. The history 
function maps parent states to valid substates of the respective XOR decomposition. 

Definition: (Start Configuration) 

For a statechart SC = (S, E, A, T, p, S hist ), we define the start configuration. 

13. C 0 : = (S 0 , histo), 

Where S 0 is defined by induction as follows: 

• S root € S 0 

• s e S 0 , p(s) = (S sub , XOR, s def ) => s def e S 0 

s € S 0 , p(s) = (S sub , AND, < AND ) => S^ e S 0 

• no other states are in S 0 

The history function of the start configuration is defined by 

14. histo : S hist -> S : s -> s def if p(s) = (S sub , XOR, s def ) 

This maps an XOR parent to its defined default state. We have to show that this 
initial history function is well-defined. 
Lemma: 

15. histo : S hist -> S is well defined. 

Proof: By definition of the statechart SC, S^ c {s e S | p(s) = (S^, XOR, s def ) } . 
Thus, V s € S hist : 3 s def € S, S sub c S : p(s) = (S sub , XOR, s def ) 

Statecharts Semantics 

The above description defines a formal model for specifying statecharts 50 in the 
state machine configurations. The above description defines a set of actions and events and 
determines when possible configurations for default are star configurations. The description below 
provides an exemplary embodiment of a state machine executing statecharts. The state machine 
exists in an original configuration and an input event results in a target configuration for the state 
machine. The target configuration can trigger zero or more available actions. According to this 
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embodiment, several rules are provided. First, the behavior of the state machine is predictable. 
For a given configuration in an input event, only one target configuration and one set of resulting 
actions can be valid (deterministic). Second, a list is provided for a set of actions. In this way, the 
order in which actions are triggered can be classified. The list, rather than a set of actions, allows 
the same action to be triggered by twice by one event (in parallel states of the state machine). 
Third, the target configuration adheres to the definition of the configuration. Generally, a function 
operates as follows: 

16. [SC]: (C, e) h-» (C\ n,, AL), 

with g IN, AL: {1 .. n, -> A} 
where SC is the statechart. 

Thus, a formal model to specify statecharts and state machine configurations is 
shown. In addition, a set of events and actions is defined. One of the possible configurations to be 
the default or start configuration is determined above. 

The actual execution of the statechart is discussed below. Wherein descriptions of 
the machine's operations as it takes an origin configuration and an input event and results in a 
target configuration, thereby triggering zero or more of the available actions. The behavior of a 
state machine shall be predictable. For a given configuration and an input event, only one target 
configuration and one set of resulting actions shall be valid. 

• The order in which the actions are triggered may be important. Thus, rather than a set of 
actions, a list is appropriate. This will also allow the same action to be triggered twice by 
one event (in parallel states of the machine). 

• The target configuration must adhere to the definition of a configuration. 

A function of the following type can be utilized: 

16. [SC]: (C, e) -> (C\ r^, AL), 
with n, e IN, AL: {1 .. n, A} 
SC is, the statechart. 

The semantics function (indicated by the Q brackets around the actual syntactical 
statechart definition SC) depends on the actual statechart. C is the original configuration, C the 
target configuration. E is the input event being processed, possibly it is the empty event e 0 . n, 
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specifies the number of resulting actions, whereas AL (action list) determines the actions 
themselves. Thus, [SC] will define the single-step behavior for a statechart SC . Several 
definitions have to be prepared before the semantics function can be specified. 

Definition: (hot states) 

For a Statechart SC = (S, E, A, T, p, S^J and a corresponding configuration 
C = (S activc , hist), the set of potentially hot states is defined as 

17. T c . — {(SgQuj.^, e, S^^, a) | S source <z S activc } 

T c denotes the transitions that could potentially be used when the next input event is 
received, i.e. the transitions whose source states are all active. Similarly, with an event ee E, hot 
states are defined as 

18. T Ce : = {(S source , e\ S^, a) € T c | e'=e ve' = e 0 } 

T c e denotes of course those elements of T c that either match the specified event or 
that do not require an input event. In the latter case, the transition specifies the empty event e 0 . 

The set T c e determines the transitions that could be used while a new input is being 
processed. Problems can arise when the order in which multiple transitions in T c e are processed 
determines the order in which their associated actions are performed. Thus, the order has influence 
on the semantics and needs to be deterministic. 

Two transitions t,, € T C e , after t { has been processed and its target states have 
been activated, the source states of tj might no longer be active. That is because activation of new 
target states usually requires deactivation of siblings. In this case, ^ cannot be processed any 
more. Therefore, choosing a predetermined execution order is even more important for the 
semantics, for not only the execution order of actions, but whether or not they are executed at all 
depends on it. 

The intermediate goal is therefore to define an order on the transitions. The first 
step, however, is to specify an order on the states of the Statechart. Execution is from left to right 
in parallel states (AND) and from the lower to the higher levels of hierarchy (XOR, i.e. leafs first, 
root last). The XOR hierarchy is clearly visible by the hierarchy function p; with XOR hierarchy, 
only one substate can be active at any time, which of course eliminates any potential non- 
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determinism. On the other hand, the order of parallel substates (AND) is defined by the < AND 
relation that comes with p: 

Definition: (order on states) 

For a Statechart SC = (S, E, A, T, p, S^) an order on the states < <= S x S is defined 

as follows: 

• VsgS: s<s (reflexive) 

V s e S: p (s) = (S sub , XOR, s dcf ) s' < s V s'g S sub 

• V s € S: p (s) = (S sub , AND, < AND ) => V s l9 s 2 € S sub : s^^^s^ 

ands'<s Vs'eS sub 

• V(s,, s 2 ) e <, (s 2 , s 3 ) g < : (s l5 s 3 ) e < (transitive closure) 

Note that this order < does not define a totally ordered set on the states in S. That is 
because siblings in XOR substates are not ordered by <. However, these siblings are only mutually 
exclusively active in any valid configuration. No two of these siblings (or their descendants) can 
be active at the same time, thus there is no need for an order that exceeds the one given above. 

Lemma: 

For a Statechart SC = (S, E, A, T, p, S hist ) and an order < c S x S as defined above, 
for each valid configuration C = (S active , hist), (S active , <) is a totally ordered set. 
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Proof: 

A totally ordered set is reflexive, transitive, and for s, s' € S aclive : s < s' or s'< s 

1. V s € S,^: s < s by definition of < (reflexive) 

2. V q, r, s, € S^^: q < r, r<s=>q<sby definition of < (transitive) 

3. Vs,s'e S activc : 

a) s g p*(s'): s is a descendant of s\ so there is n e IN, n>0: s e 
p' (n) (s'), i.e., by applying p' n times we get down to the level of s. 
Therefore, there are states s x . . . s^ so that s < s,< . . . < s^s' by 
definition of <. Thus: s < s' (due to transitive definition of <). 

b) s' € p* (s): analogous 

c) else, i.e. neither s is a descendant of s' nor vice versa: 

s and s' have a lowest common ancestor s^^^ in the hierarchy tree. 
This ancestor state must be of AND type because only this way both s 
and s* can be in s activc . The order < AND of s^^ defines the order of s 
and s'. 

Thus, for any two states that can be active at the same time, there is always an order 
for these states. This order to defines another order, an order on sets of states: 

Definition: (order on sets of states) 

For a Statechart SC = (S, E, A, T, p, S hist ), an order < c S x S as defined above and 
a subset S' c S so that (S\ <) is a totally ordered set, we define an order < set e 2 s x 2 s on sets of 
states. Let X and Y denote the subsets of S' that shall be compared; X = {x,, . . . , xj and Y = 
{yi> • • > y m }- Because (S\ <) is a totally ordered set, it can be assumed that X! < . . . < ^ and y x 

< < v 

19. X < set Y : o 3 k e IN, k>0, k< min (n,m), so that Xj = y { V i = l . . k-1 and x k <y k 
and x k ^y k or n < m and Xj = 3^ V i = 1 . . . n 
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This means that the smallest k-1 elements of both A and B are identical, and the one 
that is immediately following determines the order of the two sets. Should all n elements of the 
first set be identical to the first n elements of the second set, the first set is defined to be smaller. 

Definition: (order on transitions) 

For a Statechart SC = (S, E, A, T, p, S^, a configuration C = (S activc , hist), an 
event e e E, hot transitions t, t' e T Ce , t=(S source , e, S^, a), and t' = (S' sourcc , e', S 1 ^, a'), we 
define the order <j c T c c x T c c by 

20. t <j t' : <=> S source <^ S' source 

Using the order <,-, a set of hot transitions T hot can be described as T hot = {t^, . . . 
where ^ < . . . < tV This order determines the execution order of the state machine. 

Having this order defined is a difference to conventional Statechart models. Where 
other models support the idea that transitions and actions are processed atomically, only to find out 
later that the implementation of such an ideal model causes a number of issues, the model respects 
right from the start the fact that execution on machines is serial. Thus, the semantics are always 
executable and well-defined. 

Activating an inactive State 

When an inactive state is activated due to a transition, the action associated with the 
transition is triggered after these events occur: 

• The new state has to become member of the active states set. 

• Any siblings of the new active (XOR) state (and their descendants) have to be deactivated. 
Note: The new state is among the target state set of a transition; therefore, we may assume 
that it is indeed an XOR child. 

• Descendants of the new active state have to be activated: for XOR states, activate the last 
recently active child (history function) for history states; otherwise, active the default child 
state. For AND states, activate all descendants. 

• Ancestors of the new state have be activated. Potential siblings of XOR ancestors need to 
be deactivated. 

• The history function has to be adjusted to reflect the new situation. 

The function that performs these steps is called activate:' 
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21. Activate: 2 s x -> 2 s : (S^, s^) h> S'^ 

where = {s e S | 3 s parcm € S: p (s parcm ) = (S sub , XOR, s dcf ) a s € S sub } 

The activate function is only defined for states s^ that are XOR children (only this 
subset qualifies for target states). 

The first utility function that is computed to determine the ancestors of a state, all 
the way up to the root state. This function identifies states that have to be activated in the 
hierarchy above the transition's target state: 

22. ancestors: S -> 2 s : s h^{s* e S | s € p*(s*)} 

The function returns all those states whose substate closure contains s, i.e. it returns 
all the ancestors of s. 

Next XOR Siblings of states are identified. This will be used to deactivate siblings 
fn (and their ancestors) of activated states: 


fn 


Si 23. siblings : 2 s -> 2 s : S origin h-> {s e S | 3 s parent € S: p (s pare J = (S sub , XOR, s def ) a s € 

m S sub a S origin n S sub * { } a s € S origin } 


Thus, for a set of origin states the siblings function will return all those states that 
are siblings of at least one of the states in s origin , excluding the trivial elements that are already 
contained in s origin . 

Also, the new states that get activated below the triggered state must be determined. 
These are history states or, in absence of a defined history value, the default substates: 
24. descActivate : S 2 s : 

f { }, p (s) = terminal 

S^u u s , eSsub descActivate(s*), p (s)=(S sub , AND,< AND ) 

^ {s h } u descActivate(s h ), p (s) = (S sub , XOR, s def ) a s g S hist a s h = hist(s) 

{s d ef} ^ descActivate(s def ), p (s) = (S sub , XOR, s def ) a s eS^ 

V. Thus, the recursively defined descActivate function terminates if the argument is a 
terminal state (leaf), or it returns the history /default substate for an XOR parent and all substates 


s 
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for an AND parent. Unless a terminal state has been hit, descActivate is referenced recursively to 
also include states on lower levels of the hierarchy. 

Finally, the function definition for line 21 is delivered: 

25. activate: (S^, s^) i-» 
(Sacuve u ancestors(s new )) \ p* (siblingsCancestorsCs^))) u descActivate (s^J, s new e 

^active » ClSC 

Updating the History Function 

Once the set of active states has been changed, the history function as the second 
component of the configuration needs to be adjusted accordingly. History states are mapped to 
presently active substates if these exist; otherwise, the history function is defined by the formerly 
set value. With S active being the new configuration's set of active states and hist being the former 
history function, this works as follows: 

26. WstSingleStep^Cs^/s^, p (s) = (S sub , XOR, s def ), 

S child G S sub , S chUd € S active 

I hist(s), else 

The complete new history function for the new configuration is delivered by the 
following function: 

27. histUpdate : (S^ -> S) -» (S hist -»S) : hist h> histSingleStep hist 

histUpdate will be used after changing the active states to generate the new history 
function, making a "snapshot" of the currently active states. 

Processing an Input Event 

Upon reception of a new input event e € E in the configuration C, the following has 

to happen: 

• determine the hot transitions T c e 

• bring these transitions into their execution order as outlined above 
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• for each transition t,: 

if source states of t { active then 

activate target states of t, (multiple target states: in the order defined by <set) 
trigger action of t x 

end if 

end for 

The check for activity of the source states of a transition is necessary because 
activating a particular state in a prior iteration of the loop may have caused originally active states 
to become inactive. 

Definition: (transition semantics) 

For a Statechart SC = (S, E, A, T, p, and a transition t=(S source , e, S^, a), 
where the target states can be listed as S target ={s 1 . . . , s k } and s x < T ... <r s k , the semantics of the 
transition t is defined as follows: 

28. [t] : 2 s -> 2 s x A u {no Action} : 

Sacuve ~~ * f~ (&ctivate(activate(. . .(activate(S active , s I ),s 2 ), . . . ),s k ),a), S 

source^— ^active 

\ (Sactivc noAction), else 

A set of active states is mapped to a resulting set of active states and to the resulting 
action. Should the source states no longer be active, nothing happens, i.e., the active states are 
returned unchanged and no action is performed. 

Note: The order < is total on the set of target states because of the way we defined 
the Statechart SC. Recall that a target state set has to be consistent, i.e. there has to be a valid 
configuration that contains the target state set. For these configurations < does indeed define a total 
order on the states as demonstrated above. 

Finally, we can now specify the Statechart semantics. Recall that the semantics of a 
Statechart SC is a function [SC] : (C, e) -> (C\ i^, AL) (see formula 16). 
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Definition: (Statechart semantics) 

For a Statechart SC = (S, E, A, T, p, S^, we define the semantics function [SC] 

as follows: 

[SC] : ((S active hist), e) h> ((S' active hist'), n,, AL), with n, € IN, AL:{1 .. n^A} 
where 

• T c e denotes the hot states for a configuration C and an event e as defined in formula 18, and 
T c c can be listed as {t x . . . , tj with t x < . . . < ^ 

• S' aaive : = proj! [tj (. . . (proj, fcKS^J). . . ) 

projj (x { . . . , Xj) : =Xi is the projection to the i* element. 

• hist* :=histUpdated (hist) 

• addAction: IN x (IN->A) xA->INx (IN->A): 


((n, AL), a) k> 


(n+1, AL [n+1/a] ), a * noAction 
(n,AL) , else 


Notation: 

f [x/y] denotes the function that returns y as f(x) and f(x*) for all x* ^ x, i.e. the value for f(x) is 
replaced while the remaining function is not changed. addAction expands the definition of the 
action list AL to include a new action, which is appended to the end of the list. 

• action : = proj 2 ([tj (proj! [tj(...(proj, [ti](S active )...))) 

denotes the action of the i 01 transition that is executed for an event 

• (113, AL) :=addAction (...(addAction (0, J_), action^ . . ., action) 
is the resulting action list, where 1 denotes the undefined function. 

It is understood that while the detailed drawings, specific examples, and particular values given 
provide a preferred exemplary embodiment of the present invention, the preferred exemplary 
embodiment is for the purpose of illustration only. The method and apparatus of the invention is 
not limited to the precise details and conditions disclosed. For example, although particular 
graphical representation are shown and described, other types can be utilized. Various changes 
may be made to the details disclosed without departing from the spirit of the invention which is 
defined by the following claims. 
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